Skip to content

Malware

Ondritols

aka Onedrivetools

According to Symantec, this malware has been deployed against IT services companies in the U.S.

Ondritols, also known as Onedrivetools, is a Windows malware family.

Background

Symantec reports that this threat has been used against IT services firms across the U.S. and Europe. It operates as a multi-stage backdoor: the initial stage is a downloader that authenticates against the Microsoft Graph API, retrieves the second-stage payload from OneDrive, and runs it. That main payload fetches a publicly hosted file from GitHub, then creates a OneDrive folder named deviceId_n_<ip address> for each compromised host and uploads a file there to notify the operators that a fresh infection has occurred.


Source: Malpedia (Fraunhofer FKIE).